3.3 Given a Use Case, Recommend a Kubernetes Admission Controller Policy Configuration CCCS Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which admission policy use case is commonly used to enforce that only containers from approved registries can run?

   • AEnforcing pod security standards.
   • BSetting resource requests and limits.
   • CValidating image registries.
   • DRestricting privileged containers.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   When rolling out a new admission policy, which strategy is recommended to minimize the risk of disrupting existing workloads?

   • AUse a mutating policy to automatically fix violations without blocking.
   • BStart in dry-run mode, review the results, and then gradually enable enforcement.
   • CApply the policy only to new namespaces, leaving existing ones unchanged.
   • DEnable enforcement immediately to ensure security is not compromised.
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A platform team is deploying Kyverno to enforce security policies. They need to ensure that a policy that adds a default resource request to all pods runs before a policy that validates that resource requests are set. The team is concerned about the order of execution. What should they do to guarantee the correct order?

   • AApply the validate policy with a dryrun mode first, then apply the mutate policy, and finally switch the validate policy to enforce.
   • BDefine both policies in a single Kyverno ClusterPolicy with the mutate rule listed before the validate rule.
   • CCreate two separate ClusterPolicies and rely on alphabetical ordering of policy names to ensure the mutate policy runs first.
   • DUse OPA Gatekeeper instead, which guarantees that all mutation policies run before validation policies.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   In Kyverno, how are policies defined and applied?

   • AAs Rego policies stored in ConfigMaps and loaded by the Kyverno engine.
   • BAs Kubernetes custom resources that can validate, mutate, or generate resources.
   • CAs YAML files that must be compiled into a binary before deployment.
   • DAs annotations on namespaces that are interpreted by the Kyverno admission webhook.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A company is adopting Kyverno to enforce pod security standards. They want to ensure that all pods in the 'production' namespace run with the restricted Pod Security Standard. They also want to allow exceptions for a specific set of pods that need to run with host networking. Which Kyverno configuration should they use?

   • ACreate a ClusterPolicy with a validate rule that enforces the restricted Pod Security Standard and an exception rule that allows hostNetwork for pods with a specific label.
   • BCreate two separate ClusterPolicies: one that enforces the restricted standard and another that allows hostNetwork for the exception pods.
   • CApply the restricted Pod Security Standard label to the 'production' namespace and rely on the built-in PodSecurity admission plugin.
   • DUse OPA Gatekeeper with a Constraint that enforces the restricted standard and a second Constraint that allows hostNetwork for the exception pods.
   Reveal Solution Discussion Select an answer first